No certificate. A record instead.
The Gateway holds no SOC 2 report and no ISO 27001 certificate, and we never claim either. What you get instead is a control inventory mapped to those standards by requirement id, a signed evidence pack you verify yourself, and a record of every decision the Gateway made. A mapping is not a certificate, and we label it as a mapping. The rest of this page answers the questions a security review asks, and says where to check each answer.
The questions your review will ask
Every answer here comes from the product specification, and you can test each one on your first workload.
| Question | Answer | Where to verify |
|---|---|---|
| Where does our data live? | Each storage class declares a region, and you declare the set of regions you allow. A replica, backup, or restore target outside that set is refused when someone configures it, not after. | Residency report at /admin/v1/residency |
| What is stored, and for how long? | Trace metadata 400 days by default, screened or full payloads 30 days, activity records 1,095 days, backups 35 days. No class is retained indefinitely, you may shorten any default, and each has a published ceiling. | Retention classes in the admin API |
| Who can decrypt our provider keys? | The wrapping key never leaves the key management service. Only one minter process, running under its own workload identity, may decrypt with it. The web process has no permission on that key at all. | ADR-0005 and ADR-0010 |
| Is screening conditional on the provider? | No. Screening runs on every request, whichever provider serves it. Provider approval for a data class is a second, separate check. | Your own planted-data test |
| Can agents route around the checks? | A tool call the model proposes is judged against your policy before the agent can run it, and a call inside a stream is held until it is judged. An agent harness that never reaches the Gateway is not governed, as the limits below state. | Tool governance specification |
| Which subprocessors actually saw our traffic? | Two lists. The subprocessor register names each third party we use, its purpose, location, and transfer mechanism. The operational register is built from the record and names every provider account that served a request in a period. | Trust package, plus an evidence pack filtered by data class |
| How does an incident reach us? | A severity 1 incident opens a status page entry and notifies every affected organization within 30 minutes. Enterprise response to severity 1 is 15 minutes, with updates every 30 minutes. A post-incident report follows within 5 business days. | Support and severity tables |
| Can we get audit-ready evidence? | An evidence pack answers one stated question as a signed archive. Its manifest hashes every file, the signature is Ed25519, and the public key is published, so you can verify integrity without us. | Evidence pack specification |
| If a key leaks, how fast can we scope it? | Name the credential and a time window, and the exposure query returns the requests it sent, the models and vendors that answered, and the data classes touched. Bulk revocation handles the rest. | Exposure query on your own seeded credential |
What we do not claim
- No certification is held. Say it to your auditor in those words. The control inventory maps controls to SOC 2 criteria, ISO 27001 Annex A, and the NIST AI RMF by requirement id. A mapping is not an auditor's opinion, and the product specification forbids us from implying otherwise.
- Prompt injection is mitigated, not solved. Fixed refusal wording, screening, tool pinning, and least authority shrink what an injected model can do. No current technique proves a model will ignore adversarial instructions, and we do not claim one.
- A harness that bypasses the Gateway is not governed. Tool governance sees only the traffic that reaches it. Keeping provider keys only at the Gateway narrows the gap, and egress controls narrow it further. Work that involves no model call is outside the product entirely.
- The Gateway is a high-value target. Putting policy, captured content, and credentials in one place makes that place a bigger target. Our controls limit what a compromise can reach, but they do not make the Gateway less attractive to attack. Weigh that honestly.
- A permitted action, misused, passes every check. A stolen credential acting inside its own scope, or an approved author writing a false source page, breaks no deterministic rule. Budgets, counters, review queues, and the record limit such misuse and bring it to light afterward, but they do not prevent it.
- When you self-host, the host is yours. In a self-hosted or air-gapped deployment, host hardening, the trust store, and kernel patching are your job.
Verify it on your first workload
- Seed a test credential, send traffic through it, then run the exposure query and compare what comes back to what you actually sent.
- Plant names, card numbers, health identifiers, and a credential in every input path, then read what left: each identifier as a placeholder, and the credential refused rather than masked.
- Plant a secret-shaped canary in an input, then search every output for it.
- Point a client at a tool the policy does not offer, and confirm both the refusal and the recorded event.
- Run the emergency key rotation drill and time it against the limit we published.
- Request an evidence pack, verify its signature against the published key, then check every file hash against its manifest.
- Ask for the signed release artifact and verify it against the published provenance before installing.
Objections a reviewer raises
- "A control mapping is marketing." Each mapped control names the requirement id that satisfies it, and each requirement states an observable behavior with an acceptance check. So a reviewer can test each control instead of reading about it. Before each release, a named owner signs off that no public statement goes beyond what the specification supports.
- "Your screening will miss something." Some identifiers carry their own checksum: card numbers, bank routing numbers, and IBANs. A value that passes its own checksum is caught by arithmetic rather than by a guess. Every detector class publishes measured lower bounds for recall and precision, with sample sizes, and we publish those instead of promising zero misses.
- "You will read what screening caught." A caught value is redacted before anything is written, and the list pairing each placeholder with its real value lives only in memory while the request runs. It is erased when the request ends, so no operator, process, or record can reverse a placeholder afterward. One exception, stated openly: during a live request, a redacted value can be restored for a tool call that needs it.
- "We cannot send payloads anywhere." You can switch off request content capture, and the evidence exports still work with it off. An air-gapped deployment keeps the data plane, the control plane, and every store inside your closed network, and requires no outbound telemetry.
- "Support will read our data during an incident." Support access is time-limited, approved by your own organization owner or security administrator, and recorded in the activity record along with where the support engineer was.
Bring the review, not the trust.
We admit customers in cohorts, in waitlist order. Don't miss the next one. When your slot comes up, you run one real workload on the plan you chose, and you keep the signed evidence pack and the control mapping your auditor will read. If we stop earning our fee, leaving is the same URL change, reversed.